Malicious code in css-dwsawd-polyfill (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1c370cda09695e44d06a44bc14d14817edadc047e4dad0314edcfc752be796e9) The package name mimics a Wix thunderbolt polyfill and ships a registry-manifest.min.json that aliases legitimate @wix thunderbolt registry module names to thunderboltRegistry.js. On require, thunderboltRegistry.js runs an IIFE that uses child_process.execSync to execute shell reconnaissance (id, whoami, uname -a, ifconfig/ip addr, /etc/hosts) and fetches http://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f with the command outputs plus hostname, pid, platform, node version, and a site identifier as query parameters, tagged 'rce-poc'. A fallback path constructs a fresh Module instance to re-resolve child_process if the require cache is stubbed, ensuring execution. The destination is plain HTTP to an unrelated external host and is not caller-configurable.

Source published

5 Oct 2026 03:35:36 UTC

Source modified

5 Oct 2026 04:15:06 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.